CVE-2026-31912: CWE-1285 Improper Validation of Specified Index, Position, or Offset in Input in The Tcpdump Group libpcap

The libpcap BPF interpreter fails to properly validate specified indices, positions, or offsets within filter programs. It neither detects the absence of a return instruction at the end of the filter program buffer nor prevents jump instructions from targeting offsets outside the buffer boundaries. This flaw allows crafted filter programs to cause the interpreter to read memory beyond the intended buffer, potentially accessing up to 32GiB of process memory on 64-bit systems and the entire address space on 32-bit systems.

This vulnerability can cause the libpcap BPF interpreter to read arbitrary memory outside the filter program buffer. While it does not directly impact confidentiality or integrity, it results in a denial of service (application crash or instability) due to out-of-bounds memory access. There is no indication of code execution or information disclosure in the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor for updates from The Tcpdump Group and apply any official patches once available. Until then, avoid using untrusted or crafted filter programs that could trigger this vulnerability.